“What is concerning is that the state of California is partnering with these private companies, I think probably out of desperation, but there is very, very sensitive information that's at stake,” said Mary Stone Ross, an Oakland-based consumer privacy expert. “There's no reason why they don't put safeguards in place to make sure that it's protected.”
"California is partnering with these private companies, I think probably out of desperation, but there is very, very sensitive information at stake."
Trusting the system
“The way for contact tracing to work properly is that people have to trust the system,” Ross said. “Like, you want them to disclose a lot of information. And so if, if there's no trust there, then I think it'll be limited in its effectiveness.”
Though Ross has not used the testing service, she decided to check their disclosure policies and sent a request to Verily to see all “categories and the specific pieces of personal information that Verily has collected about me.” The company has not yet responded.
California Gov. Gavin Newsom’s office referred a request for comment to Verily and to the state’s health department. The health department did not respond to questions by press time. Verily spokeswoman Carolyn Wang contended that the company does follow the California privacy law in its collection of data, and pointed to its privacy policies on the Project Baseline website. She said Verily does not collect any information other than what it specifically mentions on the website, and does not collect biometric or geolocation data.
Sacramento lawmakers struck a deal to turn it into law, and unusually for a law that stands to affect billion-dollar companies, it remained largely unchanged by lobbying efforts through 2019.In the data economy, users’ personal information can be used in lightning-fast transactions, like the real-time auction that goes on behind each online ad, and stored in databases for decades.
Lack of oversightJackson’s letter comes weeks after Verily CEO Andrew Conrad said the company would not sell data or use it for commercial purposes. That came in reply to a March letter from Democratic Sens. Bob Menendez, (N.J.), Sherrod Brown, (Ohio), Cory Booker, (N.J.), Richard Blumenthal, (Conn.) and Kamala Harris, (Calif.), expressing concerns, among other things, that Verily requires users to use a Google account to sign up for testing, which could lead to health information being packaged with other information Google already has to profile users.
More broadly problematic is the fact that there seems to be little oversight of the company, said Samantha Corbin, a lobbyist who represents privacy groups in California. For example, the California privacy law passed in January is not going to be fully enforced until July.
“The expectation is the [California] Attorney General's office isn't going to actually enforce the law until July,” she said. “If it is enforced, this is light-touch enforcement. There's not a lot of teeth to this. So good luck catching me first, and then if you do, this is not the end of the world for me as a major tech conglomerate.”
A spokeswoman for California Attorney General Xavier Becerra declined to comment. States are largely left to their own devices because Verily is not covered by the Health Information Portability and Accountability Act, or HIPAA, a federal law that governs privacy of health records. In an April letter to Trump son-in-law and senior adviser Jared Kushner, Sens. Mark Warner, (D-Va.) and Richard Blumenthal, (D-Conn.) and Rep. Anna Eshoo, D-Calif.), expressed broad concerns about the administration’s testing policies, and specific concerns about Verily.
“That site is inexplicably not covered under HIPAA,” they wrote. “We have seen numerous examples of the limits of HIPAA undermining the strong protections we have come to expect of our sensitive health information.”Cover: A person displays their documentation behind the rolled up car window, to enter the Verily coronavirus free drive-up testing site at Cal Expo in Sacramento, Calif., Friday, March 27, 2020. (AP Photo/Rich Pedroncelli)